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Federal Trade Commission 
600 Pennsylvania Avenue, NW 
Washington, DC 20580 


Dear Chairman Simons: 

With the start of the 116th Congress, the Committee has resumed its traditional role of 
oversight to ensure that the agencies under its jurisdiction are acting in the best interest of the 
public and consistent with their legislative authority. The Federal Trade Commission (FTC) 
plays a critical role in protecting U.S. consumers from a wide variety of unfair and deceptive 
practices, including protecting consumers’ data privacy and security. As described below, we 
are writing today to better understand the resources that the FTC needs to fulfill its important 
consumer protection mission and meet the challenges posed by rapid changes in technology. 

A series of recent high-profile privacy incidents have caused significant concern to 
consumers and this Committee. In the past year alone, consumers have seen privacy scandals 
from some of the country’s largest technology companies, including the Cambridge 
Analytica/Facebook data leak;' two bugs in Google+ that allowed third-party app developers to 
access millions of users’ personal information;^ and an Amazon Alexa that shared a recording of 


‘ 87 Million Facebook Users to Find Out If Their Personal Data Was Breached, ABC News 
(Apr. 9, 2018) (abcnews.go.com/US/87-million-facebook-users-fmd-personal-data- 
breached/ story ?id=543 34187). 

^ Electronic Frontier Foundation, The Google+ Bug Is More About the Cover-Up Than the 
Crime (Oct. 11, 2019) (www.eff.org/deeplinks/2018/lO/google-bug-more-about-cover-crime); 
Google Reveals New Security Bug Affecting More Than 52 Million Users, Washington Post 
(Dec. 10, 2018) (www.washingtonpost.eom/technology/2018/12/10/google-reveals-new- 
security-bug-affecting-more-than-million-users/?utm_term=.3499d20fe0cl). 
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a couple’s conversation without permission.^ Then, just last month, Google disclosed that it’s 
Nest Secure alarm system secretly included a microphone that it never disclosed to consumers.'^ 
Additionally, massive data breaches at companies such as Equifax^ and Marriott^ have exposed 
the sensitive personal information of hundreds of millions of consumers. For every high-profile 
case, there are many more that do not get attention in the press and therefore may not be 
prioritized by the FTC. Nevertheless, consumers may face significant harm from these less well- 
known privacy and data security incidents. 

Given these significant concerns, the Committee’s Subcommittee on Consumer 
Protection and Commerce recently held a hearing entitled ‘"Protecting Consumer Privacy in the 
Era of Big Data." Members of the Subcommittee believe that legislation is needed to protect the 
privacy of our constituents and that the FTC must have additional resources and authority to 
meet these 2H‘ century challenges. 

We are writing to you to learn how the Commission could use additional budgetary 
resources to better protect consumer privacy. We would appreciate your responses to the 
following questions and respectfully request that you provide a complete written response no 
later than April 3, 2019: 

1. What resources would the FTC require to dramatically boost its enforcement 
activity with respect to privacy and data security? How would the FTC deploy 
new resources if it were to receive an additional $50 million for consumer 
protection and privacy? How about an additional $75 million? How about an 
additional $100 million? As part of your responses, please estimate the number of 
additional investigations and enforcement actions the FTC would likely be able to 
pursue. 

2. If Congress were to direct the FTC to hire technologists to aid in case 
development, enforcement, rulemaking and/or policy recommendations, what 
resources would the FTC need to fulfill its consumer protection mission and how 
would the agency deploy those new resources? Specifically, please describe the 
number of employees the agency would need, their roles and responsibilities, and 


Is Alexa Listening? Amazon Echo Sent Out Recording of Couple’s Conversation, New York 

Times (May 25,2018) (www.nytimes.eom/2018/05/25/business/amazon-alexa-conversation- 
shared-echo.html?rref==collection%2Ftimestopic%2FPrivacy). 

Users alarmed by undisclosed microphone in Nest Security System, Ars Technica (Feb. 20, 
2019) (arstechnica. com/gadgets/2019/02/googIes-nest-security-system-shipped-with-a-secret- 
microphone/). 

^ Equifax Says Cyber attack May Have Affected 143 Million in the US, New York Times 
(Sept. 7, 2017) (www.nytimes.com/2017/09/07/business/equifax-cyberattack.htmI). 

^Marriott Hacking Exposes Data of Up to 500 Million Guests, New York Times (Nov. 30, 
2018) (wv^.nytimes.com/2018/11/30/business/marriott-data-breach.html). 
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how the FTC would use these resources to further its consumer protection 
mission. 

3. If the FTC received notice-and-comment rulemaking authority with respect to 
privacy and data security, would the FTC require additional resources to develop 
and update new rules without detracting from the agency’s enforcement activity? 
If so, what resources would the FTC require? 

4. What would the FTC be able to accomplish with 100 new attorneys focused on 
privacy and data security that it cannot do with current resources? 


We appreciate your willingness to appear before the Committee when called upon and 
hope we can continue to count on you to be responsive to all Congressional inquiries in a timely 
fashion. If you have any questions regarding this inquiry, please contact Lisa Goldman of the 
Committee staff at (202) 225-2927. 


Sincerely, 




Chair 

Subcommittee on Consumer 
Protection and Commerce 



